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Listing of the Claims: OCT 0 2 2006 

The following is a complete listing of all the claims in the application, with an 
indication of the status of each: 

Claims 1-22 (Canceled). 

1 23. (New) A method of outlier detection comprising: 

2 generating a plurality of synthesized data, each representing a state within 

3 a given vector space, said generating including a random number generation; 

4 receiving a plurality of real sample data, each representing a detected real 

5 event as represented in said given vector space; 

6 forming a candidate sample set comprising a union of at least a part of 

7 said plurality of synthesized data and said plurality of real sample data, said 

8 candidate sample set having a starting population, said candidate sample set 

9 being unsupervised as to which members will be classified by said method as 

10 being outliers; 

1 1 generating a set of classifiers, each member of said set being a procedure 

12 or a representation for a function classifying an operand data as an outlier or a 

13 non-outlier, said generating a set of classifiers including: 

14 initializing said set of classifiers to be an empty set, 

1 5 selectively sampling said candidate sample data to form a learning 

16 data set, said selectively sampling including 

17 i) applying said set of classifiers to each of said candidate 

18 sample data and, if any classifiers are extant in said set, generating 

19 a corresponding set of classification results, and 

20 ii) calculating a sampling probability value for each of said 

21 candidate sample data based, at least in part, on the corresponding 

22 set of classification results, and 

23 iii) sampling from said candidate data to form said learning 

24 data set based, at least in part on said sampling probability values, 
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25 such that said learning data set has a population substantially lower 

26 than the starting population, 

27 generating another classifier based on said learning data set, 

28 updating said set of classifiers to include said another classifier, 

29 and 

30 repeating said selectively sampling, said generating another 

31 classifier, and said updating until said set of classifiers includes at least t 

32 members; and 

33 generating an outlier detection algorithm based, at least in part, on at least 

34 one of said another classifiers, for classifying a datum as being an outlier or a 

35 non-outlier. 

1 24. (New) The method of claim 23, further comprising: 

2 receiving a given mis-characterizing cost data associated with at least one 

3 of said synthesized samples, representing a cost of said outlier detection 

4 algorithm mis-characterizing said at least one synthesized sample as a non- 

5 outlier 

1 25. (New) The method of claim 24, wherein said constructing said learning data 

2 set from said candidate sample data is further based on said mis-characterizing 

3 cost 

1 26. (New) The method of claim 23, wherein said calculating a sampling 

2 probability value includes identifying a consistency within said set of classification 

3 results and calculating a probability of said identified consistency using a 

4 Binomial probability function. 

1 27. (New) The method of claim 23, wherein said calculating a sampling 

2 probability value includes identifying a consistency within said set of classification 

3 results and calculating a probability of said identified consistency using a 

4 Gaussian probability function. 
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1 28. (New) The method of claim 23, said machine-readable code for generating 

2 synthesized data generates said synthesized data in accordance with a given 

3 statistical likelihood of said generated data meeting an outlier criterion. 

1 29. (New) The method of claim 23, wherein said generating an outlier detection 

2 algorithm generates the outlier detection algorithm such that said algorithm 

3 applies an aggregate of members of said set of classification algorithms, 

4 calculates a corresponding set of detection result data representing each of said 

5 aggregate's member's classification, and applies a voting scheme to said 

6 corresponding set of detection result data. 

1 30. (New) The method of claim 23, wherein said calculating of said uncertainty 

2 value includes identifying a consistency among said set of classification results, 

3 and calculating a probability of said consistency, assuming each classification 

4 result within said set has a 50-50 probability of representing an operand as 

5 meeting said alarm criterion, statistically independent of said operand and of all 

6 other classification results within said set. 

1 31 . (New) The method of claim 30, wherein said calculating a sampling 

2 probability value further includes calculating a probability of said identified 

3 consistency using a Binomial probability function. 

1 32. (New) The method of claim 30, wherein said calculating a sampling 

2 probability value further includes calculating a probability of said identified 

3 consistency using a Gaussian probability function. 

1 33. (New) The method of claim 28, wherein said calculating of said uncertainty 

2 value includes identifying a consistency among said set of classification results, 

3 and calculating a probability of said consistency, assuming each classification 

4 result within said set has a 50-50 probability of representing an operand as 
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5 meeting said alarm criteria, statistically independent of said operand and of ali 

6 other classification results within said set. 

1 34. (New) The method of claim 33, wherein said calculating a sampling 

2 probability value further includes calculating a probability of said identified 

3 consistency using a Binomial probability function. 

1 35. (New) The method of claim 33, wherein said calculating a sampling 

2 probability value further includes calculating a probability of said identified 

3 consistency using a Gaussian function. 

1 36. (New) A system for classifying externally detected samples as one of at least 

2 normal and an outlier, comprising: 

3 a machine controller having a readable storage medium; 

4 a machine-readable program code, stored on the machine-readable 

5 storage medium, having instructions to: 

6 generate a plurality of synthesized data, each representing a state within a 

7 given vector space, said generating including a random number generation; 

8 receive a plurality of real sample data, each representing an observed 

9 event as represented in said given vector space; 

1 0 form a candidate sample set comprising a union of at least a part of said 

1 1 plurality of synthesized data and said plurality of real sample data, said candidate 

12 sample set having a starting population; 

1 3 generate a set of classifiers, each member of said set being a procedure 

14 or a representation for a function classifying an operand data as a rare event or 

15 an outlier, said generating a set of classifiers including: 

1 6 initializing said set of classifiers to be an empty set, 

1 7 selectively sampling said candidate sample data to form a learning 

18 data set, said selectively sampling including 
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1 9 i) applying said set of classifiers to each of said candidate 

20 sample data and, if any classifiers are extant in said set, generating 

21 a corresponding set of classification results, and 

22 ii) calculating a sampling probability value for each of said 

23 candidate sample data based, at least in part, on the corresponding 

24 set of classification results, and 

25 iii) sampling from said candidate data to form said learning 

26 data set based, at least in part, on said sampling probability values, 

27 such that said learning data set has a population substantially lower 

28 than the combined first and second population, 

29 generating another classifier based on said learning data set, 

30 updating said set of classifiers to include said another classifier, 

31 and 

32 repeating said selectively sampling, said generating another 

33 classifier, and said updating until said set of classifiers includes at least t 

34 members; and 

35 to generate an outlier detection algorithm based, at least in part, on 

36 at least one of said another classifiers, for classifying a datum as being an 

37 outlier or a non-outlier. 

1 37. (New) The method of claim 36, wherein said machine-readable program code 

2 further comprises instructions for 

3 receiving a given mis-characterizing cost data associated with at least one 

4 of said example abnormal state data, said cost data representing a cost of said 

5 outlier detection algorithm mis-characterizing a data equal to said abnormal state 

6 data as not meeting said alarm criterion. 

1 38. (New) The system of claim 36, wherein said machine-readable code 

2 instructions constructing said learning data set from said candidate sample data 

3 include instructions for constructing said learning data based, at least in part, on 

4 said mis-characterizing cost. 
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1 39. (New) The system of claim 36. wherein said machine-readable code 

2 instructions for calculating a sampling probability value include instructions for 

3 identifying a consistency within said set of classification results and calculating a 

4 probability of said identified consistency using a Binomial probability function. 

1 40. (New) The system of claim 36, wherein said machine-readable code 

2 instructions for calculating a sampling probability value include instructions for 

3 identifying a consistency within said set of classification results and calculating a 

4 probability of said identified consistency using a Gaussian probability function. 

1 41 . (New) The system of claim 36, wherein said machine-readable code for 

2 generating synthesized data include instruction for generating said data in 

3 accordance with a given statistical likelihood meeting an outlier criterion. 

1 42. (New) The system of claim 36, wherein said machine-readable code 

2 instructions for generating the outlier detection algorithm include instructions 

3 such that said algorithm applies an aggregate of members of said set of 

4 classification algorithms, calculates a corresponding set of detection result data 

5 representing each of said aggregate's member's classification, and applies a 

6 voting scheme to said corresponding set of detection result data. 



1 43. (New) The system of claim 36, wherein said machine-readable code 

2 instructions for calculating said uncertainty value include instructions for 

3 identifying a consistency among said set of classification results, and calculating 

4 a probability of said consistency, assuming each classification result within said 

5 set has a 50-50 probability of representing an operand as meeting said alarm 

6 criterion, statistically independent of said operand and of all other classification 

7 results within said set. 



1 44. (New) The system of claim 36, wherein said machine-readable cod 

2 instructions for calculating a sampling probability value include instructions for 
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3 calculating a probability of said identified consistency using a Binomial probability 

4 function. 

1 45. (New) The system of claim 36, wherein said machine-readable code 

2 instructions for calculating a sampling probability value include instructions for 

3 calculating a probability of said identified consistency using a Gaussian 

4 probability function. 

1 46. (New) The system of claim 41 , wherein said machine-readable code 

2 instructions for calculating of said uncertainty value include instructions for 

3 identifying a consistency among said set of classification results, and calculating 

4 a probability of said consistency, assuming each classification result within said 

5 set has a 50-50 probability of representing an operand as meeting said alarm 

6 criteria, statistically independent of said operand and of all other classification 

7 results within said set. 

1 47. (New) The system of claim 45, wherein said machine-readable code 

2 instructions for calculating a sampling probability value include instructions for 

3 calculating a probability of said identified consistency using a Binomial probability 

4 function. 

1 48. (New) The system of claim 45, wherein said machine-readable code 

2 instructions for calculating a sampling probability value include instructions for 

3 calculating a probability of said identified consistency using a Gaussian 

4 probability function. 
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